Skip to content

V
V8
Switch branch/tag
  1. 13 Feb, 2018 22 commits
    • Junliang Yan's avatar
      Reland "PPC/s390: [turbofan] Masking/poisoning in codegen (optimized code, x64)" · 66ff72a7
      Junliang Yan authored 
      This is a reland of cee362af.

Original change's description:
> PPC/s390: [turbofan] Masking/poisoning in codegen (optimized code, x64)
> 
> Port 8f489e73
> 
> Original Commit Message:
> 
>     This introduces masking of loads with speculation bit during code generation.
>     At the moment, this is done only for x64 optimized code, under the
>     --branch-load-poisoning flag.
> 
>     Overview of changes:
>     - new register configuration configuration with one register reserved for
>       the speculation poison/mask (kSpeculationPoisonRegister).
>     - in codegen, we introduce an update to the poison register at the starts
>       of all successors of branches (and deopts) that are marked as safety
>       branches (deopts).
>     - in memory optimizer, we lower all field and element loads to PoisonedLoads.
>     - poisoned loads are then masked in codegen with the poison register.
>       * only integer loads are masked at the moment.
> 
> R=mvstanton@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
> BUG=
> LOG=N
> 
> Change-Id: I7decc16bbadf87a8c8b178278eb79a9b783f79e1
> Reviewed-on: https://chromium-review.googlesource.com/916744
> Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
> Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
> Cr-Commit-Position: refs/heads/master@{#51275}

Change-Id: Id22416487b05bef06c4cfdae35811a22f21cd0a0
Reviewed-on: https://chromium-review.googlesource.com/916865Reviewed-by: 's avatarJoran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51278}
      66ff72a7
    • Camillo Bruni's avatar
      [errors] Use FATAL macro where possible · 52b3b491
      Camillo Bruni authored 
      FATAL(...) avoid creating literal strings for line number in release
mode.

Bug: v8:7310
Change-Id: I6a3e329adce36b0efcc240068f6a241d1cca4b6f
Reviewed-on: https://chromium-review.googlesource.com/915066Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
Reviewed-by: 's avatarAndreas Haas <ahaas@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51277}
      52b3b491
    • Junliang Yan's avatar
      Revert "PPC/s390: [turbofan] Masking/poisoning in codegen (optimized code, x64)" · 4513ee2e
      Junliang Yan authored 
      This reverts commit cee362af.

Reason for revert: forget to upload latest version

Original change's description:
> PPC/s390: [turbofan] Masking/poisoning in codegen (optimized code, x64)
> 
> Port 8f489e73
> 
> Original Commit Message:
> 
>     This introduces masking of loads with speculation bit during code generation.
>     At the moment, this is done only for x64 optimized code, under the
>     --branch-load-poisoning flag.
> 
>     Overview of changes:
>     - new register configuration configuration with one register reserved for
>       the speculation poison/mask (kSpeculationPoisonRegister).
>     - in codegen, we introduce an update to the poison register at the starts
>       of all successors of branches (and deopts) that are marked as safety
>       branches (deopts).
>     - in memory optimizer, we lower all field and element loads to PoisonedLoads.
>     - poisoned loads are then masked in codegen with the poison register.
>       * only integer loads are masked at the moment.
> 
> R=​mvstanton@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
> BUG=
> LOG=N
> 
> Change-Id: I7decc16bbadf87a8c8b178278eb79a9b783f79e1
> Reviewed-on: https://chromium-review.googlesource.com/916744
> Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
> Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
> Cr-Commit-Position: refs/heads/master@{#51275}

TBR=mvstanton@chromium.org,michael_dawson@ca.ibm.com,jyan@ca.ibm.com,joransiu@ca.ibm.com

Change-Id: I7e56cdcd99b3c6004803b4502ec1054e89c1e212
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/916864Reviewed-by: 's avatarJunliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51276}
      4513ee2e
    • Junliang Yan's avatar
      PPC/s390: [turbofan] Masking/poisoning in codegen (optimized code, x64) · cee362af
      Junliang Yan authored 
      Port 8f489e73

Original Commit Message:

    This introduces masking of loads with speculation bit during code generation.
    At the moment, this is done only for x64 optimized code, under the
    --branch-load-poisoning flag.

    Overview of changes:
    - new register configuration configuration with one register reserved for
      the speculation poison/mask (kSpeculationPoisonRegister).
    - in codegen, we introduce an update to the poison register at the starts
      of all successors of branches (and deopts) that are marked as safety
      branches (deopts).
    - in memory optimizer, we lower all field and element loads to PoisonedLoads.
    - poisoned loads are then masked in codegen with the poison register.
      * only integer loads are masked at the moment.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I7decc16bbadf87a8c8b178278eb79a9b783f79e1
Reviewed-on: https://chromium-review.googlesource.com/916744Reviewed-by: 's avatarJoran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51275}
      cee362af
    • Andreas Haas's avatar
      [heap] Make setting use_tasks_ explicit · 1e9504ba
      Andreas Haas authored 
      At the moment the flag is set too late, it is possible that the GC still
tries to post tasks in Isolate::Deinit when the isolate is already
disconnected from the platform, see the referenced bug.

R=ulan@chromium.org

Bug: chromium:810739
Change-Id: Ibcd226cb44cc903f2a46e7cccf682b3938c9d408
Reviewed-on: https://chromium-review.googlesource.com/915942Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51274}
      1e9504ba
    • Junliang Yan's avatar
      PPC/s390: [Ignition] [TurboFan] Generate speculation poison in code generator. · abac06aa
      Junliang Yan authored 
      Port a021b6c4

Original Commit Message:

    Moves generation of speculation poison to be based on the PC target vs the
    actual PC being executed. The speculation poison is generated in the prologue
    of the generated code if CompilationInfo::kGenerateSpeculationPoison is set.
    The result is stored in a known register, which can then be read using the
    SpeculationPoison machine node.

    Currently we need to ensure the SpeculationPoison node is scheduled right after
    the code prologue so that the poison register doesn't get clobbered. This is
    currently not verified, however it's only use is in RawMachineAssembler where
    it is manually scheduled early.

    The Ignition bytecode handlers are updated to use this speculation poison
    rather than one generated by comparing the target bytecode.

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:798964
LOG=N

Change-Id: I4b9a1b0865b6164171cf83f0e45c36c69ac08a18
Reviewed-on: https://chromium-review.googlesource.com/914848Reviewed-by: 's avatarJoran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51273}
      abac06aa
    • Mike Stanton's avatar
      [turbofan] Masking/poisoning in codegen (optimized code, x64) · 8f489e73
      Mike Stanton authored 
      This introduces masking of loads with speculation bit during code generation.
At the moment, this is done only for x64 optimized code, under the
--branch-load-poisoning flag.

Overview of changes:
- new register configuration configuration with one register reserved for
  the speculation poison/mask (kSpeculationPoisonRegister).
- in codegen, we introduce an update to the poison register at the starts
  of all successors of branches (and deopts) that are marked as safety
  branches (deopts).
- in memory optimizer, we lower all field and element loads to PoisonedLoads.
- poisoned loads are then masked in codegen with the poison register.
  * only integer loads are masked at the moment.

Bug: chromium:798964
Change-Id: Ie51fdbde578fc289dff029794f3cfe8eaf33e1ef
Reviewed-on: https://chromium-review.googlesource.com/901625
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51272}
      8f489e73
    • Michael Starzinger's avatar
      [assembler] Fix compilation for non-simulator builds. · c74af694
      Michael Starzinger authored 
      R=mvstanton@chromium.org

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I6175fd4c4e2999667ba04c89df5cd3f2b380ae0a
Reviewed-on: https://chromium-review.googlesource.com/916263Reviewed-by: 's avatarMichael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51271}
      c74af694
    • Michael Starzinger's avatar
      [turbofan] Better checking of code start register. · 5586ecfc
      Michael Starzinger authored 
      This decouples the checking of the {kJavaScriptCallCodeStartRegister}
from the deoptimization checks. We now rely more heavily on the above
register and should check its validity more broadly. Note that there
also is a bug fix for the ARM port contained in this change.

R=mvstanton@chromium.org

Change-Id: I27d8b72cb2b36a85dae4bbbf35e4dbcf150eac01
Reviewed-on: https://chromium-review.googlesource.com/916242
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: 's avatarMichael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51270}
      5586ecfc
    • Michael Starzinger's avatar
      [assembler] Make {RelocInfo} independent of the Isolate. · a7402558
      Michael Starzinger authored 
      Now that instruction cache flushing is process-wide and no longer bound
to a specific {Isolate}, we can also make setters on the {RelocInfo}
structure equally independent of the {Isolate} and remove the respective
parameter everywhere.

R=ahaas@chromium.org

Change-Id: I7b21f6f79d0d6cf73424019b9e808c3ec76de08e
Reviewed-on: https://chromium-review.googlesource.com/915922Reviewed-by: 's avatarAndreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51269}
      a7402558
    • sreten.kovacevic's avatar
      [Liftoff] Refactor conditional instructions · 1e89fed0
      sreten.kovacevic authored 
      Change prototypes of conditional jump and set instructions,
change their implementation accordingly and port these instructions
to MIPS.

Bug: v8:6600
Change-Id: I8e2c9c874f2fde9a1c1b5a34eaa9e72475e69bc5
Reviewed-on: https://chromium-review.googlesource.com/913252Reviewed-by: 's avatarIvica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: 's avatarClemens Hammacher <clemensh@chromium.org>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51268}
      1e89fed0
    • Peter Marshall's avatar
      [promise] Construct promises through API in C++, rather than CSA. · 5bc39360
      Peter Marshall authored 
      We don't need to pay the cost of going to JS to simply stamp out a
new object.

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I8942771ff9c19dff1908243fd6d3bd701d3fb5a3
Reviewed-on: https://chromium-review.googlesource.com/897803
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51267}
      5bc39360
    • Michael Starzinger's avatar
      [assembler] Remove dead {kNoCodeAgeSequenceLength} constant. · fc04f8ce
      Michael Starzinger authored 
      R=clemensh@chromium.org

Change-Id: Ife4b31e5484314e3e9d51344c446fae4952bbbbf
Reviewed-on: https://chromium-review.googlesource.com/913616Reviewed-by: 's avatarClemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51266}
      fc04f8ce
    • Sigurd Schneider's avatar
      Reland "[cleanup] Harden the SubString CSA/Runtime implementations." · bb282636
      Sigurd Schneider authored 
      This is a reland of 6d5b54df82e27a82811a836dcdbbfe26829f0e6d
Original change's description:
> [cleanup] Harden the SubString CSA/Runtime implementations.
>
> Remove the self-healing for invalid parameters in the
> CodeStubAssembler::SubString helper and the %SubString runtime function,
> which is used as a fallback for the CodeStubAssembler implementation.
> All call sites must do appropriate parameter validation anyways now that
> the self-hosted JavaScript builtins using these helpers are gone, and we
> have proper contracts with the uses.
>
> Also remove the context parameter from the CodeStubAssembler::SubString
> method, which is unnecessary, since this can no longer throw an
> exception.
>
> Bug: v8:5269, v8:6936, v8:7109, v8:7137
> Change-Id: I19d93bad5f41faa0561c4561a48f78fcba99a549
> Reviewed-on: https://chromium-review.googlesource.com/795720
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49702}

Bug: v8:5269, v8:6936, v8:7109, v8:7137
Change-Id: I5e84998a2dd3990d7981505b401ffc770e0b7ac5
Reviewed-on: https://chromium-review.googlesource.com/913130Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51265}
      bb282636
    • Georg Neis's avatar
      [ic] Remove impossible cases from FeedbackNexus::ConfigureUninitialized(). · 58807a6f
      Georg Neis authored 
      Change-Id: I835e6c7b5520b5ab5ad796e25a197e5b43cb9e58
Reviewed-on: https://chromium-review.googlesource.com/913569
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: 's avatarMichael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51264}
      58807a6f
    • Clemens Hammacher's avatar
      [Liftoff] Add f64 support · b61b715c
      Clemens Hammacher authored 
      This CL adds support for f64.const, f64.add, f64.sub and f64.mul.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: I7374ede800db83303c8fa647a183fdda53a151cd
Reviewed-on: https://chromium-review.googlesource.com/913613Reviewed-by: 's avatarAndreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51263}
      b61b715c
    • v8-autoroll's avatar
      Update V8 DEPS. · da4f9119
      v8-autoroll authored 
      Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/792040c..1ae61ca

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/2637e7e..a09e064

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c60b98d..e7298f3

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I267b24e59799c9e18735851336d7787252dc59e2
Reviewed-on: https://chromium-review.googlesource.com/915702Reviewed-by: 's avatarv8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51262}
      da4f9119
    • Benedikt Meurer's avatar
      [builtins] Optimize PromiseResolveThenableJob for the common case. · 1f8dcc5d
      Benedikt Meurer authored 
      The idea here is that in case the `thenable` is a JSPromise and `then`
is the initial `Promise.prototype.then` method, and the @@species lookup
chain is intact, we can skip creating the temporary promise and the
closures (with the shared context), and instead directly call into our
PerformPromiseThen. This is sound since - given above mentioned
conditions - our short-cut

  PerformPromiseThen(thenable, undefined, undefined, promise_to_resolve)

is not observably different from the actual

  resolve, reject = CreateResolvingFunctions(promise_to_resolve)
  result_capability = NewPromiseCapability(%Promise%)
  PerformPromiseThen(thenable, resolve, reject, result_capability)

except through PromiseHooks (and potentially via the async stack
traces). So we disable the fast-path if either promise hooks are enabled
or the debugger is active for now.

This improves the performance on the wikipedia benchmark by 20-25% and
the bluebird-doxbee benchmark by around 20%.

Bug: v8:7253
Change-Id: I23c92ad365c2b71d65057573f2d8febe2afe00b0
Reviewed-on: https://chromium-review.googlesource.com/911800
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: 's avatarSathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51261}
      1f8dcc5d
    • Benedikt Meurer's avatar
      [builtins] Refactor the promise resolution and rejection logic. · c0412961
      Benedikt Meurer authored 
      This introduces dedicated builtins

  - FulfillPromise,
  - RejectPromise, and
  - ResolvePromise,

which perform the corresponding operations from the language
specification, and removes the redundant entry points and the
excessive inlining of these operations into other builtins. We
also add the same logic on the C++ side, so that we don't need
to go into JavaScript land when resolving/rejecting from the
API.

The C++ side has a complete implementation, including full support
for the debugger and the current PromiseHook machinery. This is to
avoid constantly crossing the boundary for those cases, and to also
simplify the CSA side (and soon the TurboFan side), where we only
do the fast-path and bail out to the runtime for the general handling.

On top of this we introduce %_RejectPromise and %_ResolvePromise,
which are entry points used by the bytecode and parser desugarings
for async functions, and also used by the V8 Extras API. Thanks to
this we can uniformly optimize these in TurboFan, where we have
corresponding operators JSRejectPromise and JSResolvePromise, which
currently just call into the builtins, but middle-term can be further
optimized, i.e. to skip the "then" lookup for JSResolvePromise when
we know something about the resolution.

In TurboFan we can also already inline the default PromiseCapability
[[Reject]] and [[Resolve]] functions, although this is not as effective
as it can be right now, until we have inlining support for the Promise
constructor (being worked on by petermarshall@ right now) and/or SFI
based CALL_IC feedback.

Overall this change is meant as a refactoring without significant
performance impact anywhere; it seems to improve performance of
simple async functions a bit, but otherwise is neutral.

Bug: v8:7253
Change-Id: Id0b979f9b2843560e38cd8df4b02627dad4b6d8c
Reviewed-on: https://chromium-review.googlesource.com/911632Reviewed-by: 's avatarSathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51260}
      c0412961
    • Sergiy Byelozyorov's avatar
      Add Peter as an owner of the JSTests benchmark · 07955372
      Sergiy Byelozyorov authored 
      This information is useful to know whom to assign bugs to when these tests are
crashing on our infrastructure.

R=petermarshall@chromium.org

No-Try: true
Change-Id: Ia165e0236602cae73e144011537d642e3535fa6b
Reviewed-on: https://chromium-review.googlesource.com/908563
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: 's avatarPeter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51259}
      07955372
    • Sergiy Byelozyorov's avatar
      Whitespace CL · 5e006978
      Sergiy Byelozyorov authored 
      R=sergiyb@google.com

No-Try: true
Bug: chromium:616879
Change-Id: If52f419c7447c88313526fceed10e7dd2e89b10c
Reviewed-on: https://chromium-review.googlesource.com/913948
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: 's avatarSergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51258}
      5e006978
    • Sergiy Byelozyorov's avatar
      Correct try bucket name for internal V8 bots on swarming · d8dc1fc5
      Sergiy Byelozyorov authored 
      TBR=machenbach@chromium.org

No-Try: true
Bug: chromium:616879
Change-Id: I49d3f12216cdc2d26761e8f82fef18512d8eb6fd
Reviewed-on: https://chromium-review.googlesource.com/915141
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: 's avatarSergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51257}
      d8dc1fc5
  3. 12 Feb, 2018 18 commits